2026-11-01T0256Z-intel

Verification & coverage notes

• Window: standard class, gap 24.0 h to 2026-10-31T0256Z-intel, window 26 h. The window is a Saturday and a Sunday: every authority and trade feed in the slices has its newest item on 2026-10-30 or earlier (NCSC.ch security hub 2026-10-30T14:22Z, BACS pages 2026-10-27 and older, NCSC-NL, BSI, CERT-EU, CERT.at, CERT-PL, ENISA, NCSC-UK, CISA, Inside IT, Netzwoche). A thin window is the healthy outcome here, not a miss.
• KEV sweep: kev_window_diff.py found no CISA KEV additions inside the window, and S1's own read of catalog 2026.10.30 agrees (the newest additions, the two Ivanti flaws of 2026-10-30, are covered). No KEV row needs a disposition.
• Backlog: the ARX Group SA / Aurora row stays held. S4 re-checked on 2026-11-01 (DE, FR, IT and EN searches; Inside IT through 2026-10-30; the tio.ch, SRF, RTS, Netzwoche, ICTjournal and Blick listings; the arx.ing homepage) and found no statement from ARX, SBB, ASTRA or Swiss press; Ransomware.live still shows the bare claim with no press link. The row's expiry stays 2026-11-07, struck if the condition is unmet.
• Dispositions (PD-8): the PAN-OS naming and the Unit 42 verification are an update on 2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release; the Fragnesia entry carried the same stale "one unnamed vendor" statement and takes an improvement that names the vendor without re-floating it; the PHP2Shell main entry takes an update that names the vendor and adds GreyNoise's sensor data and Hunt.io's captures (follow-up FU1, spawned on the verifier's missed-angle finding). GTIG and Mandiant's incident-response report is an update on the ARTEX entry; Microsoft's trust-list removal, Cisco's advisory v1.5 and GitLab's release are an update on the eMudhra entry.
• Recency (PD-7): the PAN-OS update rests on Dream Research (2026-10-29) and Unit 42 (2026-10-29), and the eMudhra update on Microsoft (2026-10-26), GitLab (2026-10-29), Python (2026-10-26) and Cisco v1.5 (2026-10-30), all dated before the 26 h horizon of 2026-10-31T00:56Z and none carried by the previous fire. They are admitted as first coverage from rotational sources' lookback (Dream through S3, GitLab through S1) and as changelog records on covered entries that predate them, each moving what a reader does (the post-patch compromise check and the Windows trust-list removal). The GreyNoise tracker (2026-11-01) and Hunt.io (2026-10-28, revised 2026-10-30) additions to the PHP2Shell entry come from the FU1 follow-up. The GTIG report is in window.
• Sourcing: the Vaud entry is single-source-victim; RTS repeats the canton's release and adds a pupil suspicion without a further named source, which the entry attributes to RTS. The PAN-OS entry moves from single-source to multi-source (Dream Research and Unit 42 describe the chain; the two worked together, so credibility stays 2 and the actor claim rests on Dream's relay of Unit 42's CL-UNK-1280 designation). Hunt.io's PAN-OS rooting sentence relays Dream and Unit 42 and is not an independent vantage.
• Source inconsistencies carried: GTIG's introduction lists ARTEX, Hexstrike and CAIRN while its observations list ARTEX, PentAGI and CAIRN (sourcing note of the ARTEX entry). Dream says the PAN-OS management web server also fronts the GlobalProtect portal, while Palo Alto's advisory says GlobalProtect is not affected; the entry states both, attributed (see the Contradiction line). Dream's page title counts 25 servers where earlier text counted 24 (24 batch-rooted firewalls plus the internal management server).
• Contradiction: Dream says the PAN-OS management web server also fronts the GlobalProtect portal; Palo Alto's advisory says GlobalProtect is not affected. The PAN-OS entry states both, attributed. Hunt.io says PAN-OS runs one uniform PHP 8.0.30 build and that the exploit reliably roots it; Dream lists PHP 7.4.33 on PAN-OS 11.1 and 24 rooted of 240 targeted. The entries carry Dream's version and count only.
• borderline-drop: ESET APT Activity Report Q2 to Q3 2026: no Swiss or public-sector finding beyond the MDaemon item already covered.
• borderline-drop: Talos VOLTA and NIK C2 (AI-integrated implants): effort-displacement novelty with no decision change; NIK C2 is also outside the window.
• borderline-drop: Kaspersky NetamLoader: one Asian victim, no attribution, no constituency nexus.
• borderline-drop: Check Point Yoba: XMRig miner payload through fake AI-app repositories, no nexus.
• borderline-drop: Huntress camera-management-software intrusion: vendor and initial access unknown, low confidence.
• borderline-drop: Binance USD 6.36 billion theft: passes only the global-scale clause, no Swiss nexus, and the vector is one clause (a DevOps laptop and a service container) with no transferable technique detail.
• borderline-drop: Chainalysis intrusion: method undisclosed, no Swiss customer named (incident floor).
• borderline-drop: Northflank environment-variable exposure: no Swiss or public-sector nexus.
• borderline-drop: Node2Shell vendor-list additions (Cisco still investigating, Prisma Cloud Transporter Client 0.2.9, Stormshield Management Center 3.9.4): marginal product-list additions on a covered entry.
• borderline-drop: Android SMS of Death (CVE-2026-58882): denial of service only, and the CVE id comes from BleepingComputer alone with no NVD or EUVD record on 2026-11-01.
• borderline-drop: TeamViewer TV-2026-1011 (CVE-2026-111585 and two more, fixed in 15.83): a user-interaction flaw that needs the viewer to connect to a hostile host, no exploitation known, patchable in the normal cycle; the sources date from 2026-10-28 to 2026-10-30.
• borderline-drop: Sophos GOLD OGRE/Aur0ra AI-agent ransomware and Microsoft's North Korean AI-adoption post: no constituency decision.
• borderline-drop: SIHF portal credential-abuse breach, Holcim leak-site claim, SALEG and INED claims, Oberspreewald-Lausitz district administration: no Swiss public-sector nexus or no victim confirmation.
• Carry-forward for the next fire (S1): Cisco's advance notice of 2026-10-28 says advisories for ISE, UCS Central and Unified CM publish on 2026-11-04.
• Candidate source added: vd-ch-press-releases (primary for cantonal disclosures; both S2 and S4 proposed it). Proposed and not added, to keep to about one per run: letemps-cyber, ms-trusted-root-program, remedio-research, php.events.greynoise.io (GreyNoise's per-flaw event tracker, worth a per-fire check while a flaw is in KEV). Recipe findings are in the sources_changed notes: mandiant-gtig (the FeedBurner feed lags and missed the 2026-10-31 post), enisa-euvd, lab52, swissinfo-ger, phorion.
• Coverage gaps: connectwise-trust-center (403 on every transport); ox-security (article bodies 403); lab52 (feed SSL EOF, listing read through the reader, nothing in horizon); Tamedia pages (tagesanzeiger.ch, 24heures.ch) fall to the metered reader or return page chrome.
• Watchlist: not configured (product, supplier and standing-interest lists empty).
• Source-health repairs of this fire (UNSOLVED list): sans-isc now reads its feed (fetch_method rss, health_cmd feed), frenchbreaches gets a feed health_cmd, vd-ch-press-releases is content_scope: general-news; ico-uk stays flagged needs-demote because the direct sitemap read, extract and WebFetch all timed out today, a transport timeout that never demotes (the recipe worked on 2026-10-22 and 2026-10-27).
• Verifier iteration 1 (NEEDS_FIXES, 23 findings) was remediated before iteration 2; its follow-up research FU1 ran on the missed-angle finding. The run's own verification block carries the outcomes.
• Verification: eight iterations, the cap. Iteration 1 returned NEEDS_FIXES with 23 findings and iteration 5 a first CLEAN (three advisories left); the confirmation pass, iteration 6, returned NEEDS_FIXES (two truth findings, both fixed), and iterations 7 and 8 returned NEEDS_FIXES on small wording, date and citation defects. The loop ended at the cap and publishes under the fail-open rule with verification_residual_count 3, the truth and editorial findings of iteration 8. Those three (a Threat ID range on the PAN-OS entry, an OpenJDK citation date on the eMudhra entry, a "first documented code execution" claim on the PHP2Shell entry) were corrected after the last pass and are not re-verified; the next quality audit should give those three entries an independent read.